Guardium Data Protection CVE-2026-84071

Requires a privileged authenticated account (PR:H) on IBM Guardium Data Protection 12.2 with access to the Universal Connector plugin upload functionality; the attacker must supply a file whose filename contains shell metacharacters that get incorporated into a shell command. Exploitation is limited by the high-privilege authentication prerequisite - an ordinary or unauthenticated user cannot reach the vulnerable code path - and is confined to the specific Universal Connector upload feature rather than any default network-facing surface. No user interaction by a victim is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) describes a network-reachable OS command injection yielding full confidentiality, integrity and availability impact with root-level command execution. The single most important limiting signal is PR:H: exploitation requires an already-privileged authenticated account on the appliance, which sharply narrows the realistic attacker population to insiders or attackers who have already compromised a high-privilege credential - this is why the base score lands at 7.2 rather than the 8.8-9.8 seen in the unauthenticated Guardium siblings (CVE-2026-82340, CVE-2026-81657). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent (no conflict between vector and description); the description's 'privileged authenticated attacker' matches PR:H exactly. Net: a genuine, well-characterized root-RCE flaw whose real-world priority is moderated by the high privilege prerequisite and the niche footprint of the product - patch on a normal cycle, prioritizing appliances where lower-trust operators hold privileged accounts.

A privileged authenticated operator (or an attacker who has stolen such credentials) uses the Universal Connector plugin upload feature to submit a file whose filename embeds shell metacharacters; the application incorporates that filename unsanitized into a shell command, executing the attacker's payload as root. No public exploit code is known, but the technique (filename-based OS command injection) is trivial to reproduce once privileged access is held. Because AC:L, no special timing or environmental conditions are needed beyond reaching the upload function.